OPNsense 26.1.5 → 26.1.7

2 releases · 0 breaking changes · 3 security fixes · 3 advisories fixed

3security0breaking0deprecated0feature0fix

Is 26.1.5 affected? · What changed up to 26.7.7

Vulnerabilities fixed by this upgrade

9.1 CVE-2026-44193 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution.…
5.3 CVE-2026-44195 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication…
8.2 CVE-2026-34578 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ld…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-44193: OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution.… in 26.1.7
security Fixes CVE-2026-44195: OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication… in 26.1.7
security Fixes CVE-2026-34578: OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ld… in 26.1.6

Every release in between

26.1.7 Apr 30, 2026 Release notes ↗

securityFixes CVE-2026-44193: OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution.…

securityFixes CVE-2026-44195: OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication…

26.1.6 Apr 9, 2026 Release notes ↗

securityFixes CVE-2026-34578: OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ld…